/***************************************************************************
 *   Copyright (C) 2010 by programmeboy                                    *
 *   programmeboy@gmail.com                                                *
 *                                                                         *
 *   This program is free software; you can redistribute it and/or modify  *
 *   it under the terms of the GNU General Public License as published by  *
 *   the Free Software Foundation; either version 2 of the License, or     *
 *   (at your option) any later version.                                   *
 *                                                                         *
 *   This program is distributed in the hope that it will be useful,       *
 *   but WITHOUT ANY WARRANTY; without even the implied warranty of        *
 *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the         *
 *   GNU General Public License for more details.                          *
 *                                                                         *
 *   You should have received a copy of the GNU General Public License     *
 *   along with this program; if not, write to the                         *
 *   Free Software Foundation, Inc.                                        *
 *   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             * 
 ***************************************************************************/
 
#ifndef _PROCESS__H__
#define _PROCESS__H__

#include <ntifs.h>

#include "common.h"

#define ProcessObject 3

typedef struct _PROCESS_INFO_LIST
{
    PEPROCESS Process;
    ULONG ProcessID;
    ULONG ParentProcessID;
    LARGE_INTEGER CreateTime;
    WCHAR FileName[MAX_PATH];

}PROCESS_FULL_INFO, *PPROCESS_FULL_INFO;

UCHAR *
PsGetProcessImageFileName(
    IN PEPROCESS Process
);

HANDLE
PsGetProcessInheritedFromUniqueProcessId(
    IN PEPROCESS Process
);

typedef BOOLEAN (*EX_ENUMERATE_HANDLE_ROUTINE)(
    IN PHANDLE_TABLE_ENTRY HandleTableEntry,
    IN HANDLE Handle,
    IN PVOID EnumParameter
    );

NTKERNELAPI
BOOLEAN
ExEnumHandleTable (
    IN PHANDLE_TABLE HandleTable,
    IN EX_ENUMERATE_HANDLE_ROUTINE EnumHandleProcedure,
    IN PVOID EnumParameter,
    OUT PHANDLE Handle
);

NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
    IN HANDLE ProcessHandle,
    IN PROCESSINFOCLASS ProcessInformationClass,
    OUT PVOID ProcessInformation,
    IN ULONG ProcessInformationLength,
    OUT PULONG ReturnLength OPTIONAL
    );

//
//  Myself defination
//

NTSTATUS
QueryProcessInfoListByAPI(
    OUT PVOID ProcessInfoBuffer,
    IN ULONG BufferLength,
    OUT PULONG Length
);

NTSTATUS
QueryProcessInfoListByActiveList(
    OUT PVOID ProcessInfoBuffer,
    IN ULONG BufferLength,
    OUT PULONG Length                             
);

NTSTATUS
QueryPspCidTable(
    OUT PULONG PspCidTable 
);

NTSTATUS
QueryProcessInfoListByCidTable( 
    OUT PVOID ProcessInfoBuffer,
    IN ULONG BufferLength,
    OUT PULONG Length                             
);

NTSTATUS
QueryProcessInfoListByHandleTable(
    OUT PVOID ProcessInfoBuffer,
    IN ULONG BufferLength,
    OUT PULONG Length
);

NTSTATUS
    QueryProcessFullName(
    IN PEPROCESS Process,
    OUT PUNICODE_STRING pImageName
);

#endif